Description
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kozea | WeasyPrint | < 68.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | weasyprint | 69.0-1 | — |
| Debian 13 | weasyprint | No fix yet | — |
| Debian 12 | weasyprint | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | weasyprint | No fix yet | — |
| Ubuntu 26.04 LTS | weasyprint | No fix yet | — |
| Ubuntu 25.10 | weasyprint | No fix yet | — |
| Ubuntu 24.04 LTS | weasyprint | No fix yet | — |
| Ubuntu 22.04 LTS | weasyprint | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | weasyprint | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-weasyprint | 68.0-1.1 | openSUSE-SU-2026:10079-1 |
| openSUSE Leap 16.0 | python-weasyprint | 65.1-bp160.2.1 | openSUSE-SU-2026:20069-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Hands-on vulnerability management case study: how Wazuh flagged a real SSRF (CVE-2025-68616) in WeasyPrint, and how I reproduced and patched it.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | weasyprint | < 68.0 | 68.0 | GHSA-983w-rhvv-gwmv |
Advisories 2
- openSUSE-SU-2026:20069-1 Security update for python-weasyprint SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10079-1 python311-weasyprint-68.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026